@liustack/modlens 3.18.0 → 3.18.2

package/CHANGELOG.md

@@ -1,5 +1,16 @@
 # Changelog
 
+## 3.18.2 - 2026-08-17
+
+- **dsh: the settings card no longer sets off Safari's password manager ([#56](https://github.com/liustack/modlens/issues/56)).** Safari's iCloud Keychain offers to enable autofill for any site carrying a password input, then shows its bubble whenever that field is focused. Here it did so for a field that is always empty: API keys live in `~/.modlens/config.json` and the host route reports only whether one is stored, never the key itself. `autocomplete="off"` cannot turn it off either, because WebKit ignores it on password fields on purpose. The field is masked with `-webkit-text-security` now, which hides the characters without ever being a password field, and it keeps a key meant for one machine out of a synced keychain. Where a browser lacks that property the field stays a password input: the nuisance is worth more than an API key rendered in clear text while somebody types it.
+  Two things worth knowing rather than discovering. A password input carries a protected state into the accessibility tree and screen readers stop reading characters back because of it, while masking is only paint, so VoiceOver and NVDA will read this field aloud and ARIA has nothing that restores the difference. It is accepted here because the field is empty in normal use, so what can be read back is what you are typing at that moment rather than a stored secret. And dsh's own model settings still contain password inputs, so Safari's site-level offer to enable autofill can still appear from those; what this removes is the bubble on the modlens field. Thanks to @RSJguoke, whose report named the WebKit behaviour and the reason `autocomplete` cannot help.
+
+## 3.18.1 - 2026-08-17
+
+- **dsh: pasted files are collected instead of piling up forever ([#51](https://github.com/liustack/modlens/issues/51)).** The paste-to-path route cannot delete its file when the request ends: the path it returns is what goes into the composer, so the file has to outlive the response and survive until the model reads it. Nothing collected them afterwards, so every paste left a directory behind for as long as dsh stayed installed. The attachment route already cleaned up after itself, which is why only this half leaked, and the reporter spotted exactly that asymmetry.
+  Pastes now live under one directory of ours rather than loose in the system temp directory, and expired ones are swept at the next paste: no timer to own, nothing running while nobody is pasting, and the work lands at a moment that already costs a disk write. Two limits, because one is not enough. The clock is a week, and it is a proxy rather than a proof, since the path leaves through the composer as plain text and nothing here observes whether the draft holding it was sent or abandoned; it errs long because deleting too early breaks a draft somebody is still writing, while deleting too late costs kilobytes in a directory the OS already collects. The ceiling is a gigabyte, because one image may be 25 MB and a week is long enough for a burst to reach many of them before any expires; it removes oldest first, which is a worse rule than liveness and the only one available.
+  The store itself is treated as untrusted ground, since its path is predictable and the system temp directory is shared. The parent is resolved, the directory is created inside the resolved path, and then it is checked rather than assumed: a link, a file, or another user's directory is refused, and one that cannot be made private is refused rather than used, because what it holds is your images. A directory whose size cannot be measured is booked at the largest a paste may be, since a quietly low number would let the store pass a ceiling it had already exceeded. Thanks to @xiyoucheng, whose report named the asymmetry with the attachment route and made the cause obvious.
+
 ## 3.18.0 - 2026-08-16
 
 - **Windows: the CLI providers start again, and a shim is now read by recognising it rather than parsing it ([#43](https://github.com/liustack/modlens/issues/43)).** npm installs a compiled CLI as a `.cmd` that runs the `.exe` beside it, and handing that `.cmd` to spawn is the `EINVAL` that broke the `claude-cli` fallback and the `opencode` reuse probe. The first attempt at this classified each line of the batch file against a whitelist and reasoned about the ones it recognised. Review found eight defects in it, every one the same shape: a line cannot be judged on its own, because whether it runs at all is a property of the file. The last was an `IF EXIST` whose condition is false, where `cmd` runs nothing and the reader still produced a plan that launched the provider. Trading a loud failure for a silent wrong action is worse than the bug being fixed, so that version was withdrawn from 3.17.1 rather than shipped.

package/README.md

@@ -6,7 +6,7 @@
 
 <p align="center"><b>Give a text-only model sight, and just paste the image.</b></p>
 
-<p align="center">🥇 <b>The FIRST vision plugin for DeepSeek Harness (dsh)</b> 🥇</p>
+<p align="center">🥇 <b>The most capable vision plugin for DeepSeek Harness (dsh)</b> 🥇</p>
 
 <p align="center">
   <a href="./README.zh-CN.md">简体中文</a> ·
@@ -14,7 +14,7 @@
   <a href="skills/modlens/references/configure.md">Configuration</a> ·
   <a href="docs/output-schema.md">Output contract</a> ·
   <a href="docs/security.md">Security</a> ·
-  <a href="https://github.com/liustack/modsearch">ModSearch (web)</a>
+  <a href="https://github.com/liustack/modsearch"><b>🔎 ModSearch (web search)</b></a>
 </p>
 
 <p align="center">
@@ -34,7 +34,7 @@ Issues are welcome any time: [open one](https://github.com/liustack/modlens/issu
 
 ## Highlights
 
-**🥇 The first vision plugin for DeepSeek Harness (dsh):** one command, `npx -y @deepseek-ai/dsh plugin --profile web add @liustack/modlens@3.18.0`, and the text-only DeepSeek model behind dsh reads images through a native `modlens_read_image` tool. Updating is the same command again. The version is named rather than `@latest` on purpose: pnpm 11 holds back releases published in the last 24 hours and resolves the tag against what survives, so `@latest` would install whatever shipped a day ago ([details](docs/harness-setup.md#keeping-it-up-to-date)).
+**🥇 The most capable vision plugin for DeepSeek Harness (dsh):** one command, `npx -y @deepseek-ai/dsh plugin --profile web add @liustack/modlens@3.18.2`, and the text-only DeepSeek model behind dsh reads images through a native `modlens_read_image` tool. Updating is the same command again. The version is named rather than `@latest` on purpose: pnpm 11 holds back releases published in the last 24 hours and resolves the tag against what survives, so `@latest` would install whatever shipped a day ago ([details](docs/harness-setup.md#keeping-it-up-to-date)).
 
 Pasting an image works two ways. **① Just paste.** On a text-only model the pasted image lands as a private temp file and its path enters the composer — the same interaction OpenCode and Pi ship — and the `modlens_read_image` tool takes it from there. **② Pick a `(modlens vision)` entry** in the model selector (it remembers your choice, so once is enough), then paste: the thumbnail stays visible in your message, closer to the Codex app feel, and the image is converted to structured evidence at request time, answered by the same underlying route. The plugin auto-discovers every provider route carrying text-only DeepSeek or GLM models and adds a wrapped entry per route (a stock install gets **`DeepSeek-V4-Flash (modlens vision)`** and **`DeepSeek-V4-Pro (modlens vision)`**; extra routes like opencode-go or zai get their own); the two families' own vision models are excluded automatically. Which paste route applies is the host's per-model call: only a model its metadata positively confirms text-only is taken over, anything unconfirmed is left alone, so vision models keep their native paste ([details](docs/harness-setup.md)).
 

package/README.zh-CN.md

@@ -6,7 +6,7 @@
 
 <p align="center"><b>为纯文本模型补上视觉能力，直接粘贴图片就能识别。</b></p>
 
-<p align="center">🥇 <b>全网第一个支持 DeepSeek Harness（dsh）的视觉插件</b> 🥇</p>
+<p align="center">🥇 <b>全网最强的 DeepSeek Harness（dsh）视觉插件</b> 🥇</p>
 
 <p align="center">
   <a href="./README.md">English</a> ·
@@ -14,7 +14,7 @@
   <a href="skills/modlens/references/configure.zh-CN.md">配置</a> ·
   <a href="docs/output-schema.zh-CN.md">输出契约</a> ·
   <a href="docs/security.zh-CN.md">安全</a> ·
-  <a href="https://github.com/liustack/modsearch">ModSearch（联网）</a>
+  <a href="https://github.com/liustack/modsearch"><b>🔎 ModSearch（联网搜索）</b></a>
 </p>
 
 <p align="center">
@@ -34,7 +34,7 @@ DeepSeek 和 GLM 的主力对话模型是纯文本的，无法进行图片识别
 
 ## 亮点
 
-**🥇 全网第一个支持 DeepSeek Harness（dsh）的外挂视觉识别插件：**一条命令 `npx -y @deepseek-ai/dsh plugin --profile web add @liustack/modlens@3.18.0`，dsh 背后的纯文本 DeepSeek 模型即可通过原生 `modlens_read_image` 工具读图。更新就是再跑一遍同一条命令。这里点名版本号而不用 `@latest` 是有意的：pnpm 11 会扣住最近 24 小时内发布的版本，dist-tag 只在剩下的里面解析，用 `@latest` 装到的会是一天前发布的那个（[细节](docs/harness-setup.zh-CN.md#保持更新)）。
+**🥇 全网最强的 DeepSeek Harness（dsh）外挂视觉识别插件：**一条命令 `npx -y @deepseek-ai/dsh plugin --profile web add @liustack/modlens@3.18.2`，dsh 背后的纯文本 DeepSeek 模型即可通过原生 `modlens_read_image` 工具读图。更新就是再跑一遍同一条命令。这里点名版本号而不用 `@latest` 是有意的：pnpm 11 会扣住最近 24 小时内发布的版本，dist-tag 只在剩下的里面解析，用 `@latest` 装到的会是一天前发布的那个（[细节](docs/harness-setup.zh-CN.md#保持更新)）。
 
 DeepSeek Harness 粘贴识图有两种玩法。
 
@@ -69,7 +69,7 @@ agy                                                           # 浏览器完成
 **DeepSeek Harness（dsh）用户不走 skill 流程**，本包就是原生 dsh 插件：
 
 ```sh
-npx -y @deepseek-ai/dsh plugin --profile web add @liustack/modlens@3.18.0
+npx -y @deepseek-ai/dsh plugin --profile web add @liustack/modlens@3.18.2
 ```
 
 装完即有 `modlens_read_image` 工具，选「(modlens vision)」模型变体即可直接粘贴识图。引擎配置同样在 `~/.modlens`，详见[宿主接入](docs/harness-setup.zh-CN.md)。

package/dist/main.js

@@ -4565,7 +4565,7 @@ function parsePositiveInt(raw, flag) {
   }
   return Number.parseInt(raw, 10);
 }
-program.name("modlens").description("Plug-in vision for text-only LLMs: image in, structured JSON evidence out").version("3.18.0");
+program.name("modlens").description("Plug-in vision for text-only LLMs: image in, structured JSON evidence out").version("3.18.2");
 program.command("analyze", { isDefault: true }).description("Analyze an image into structured JSON evidence (default command)").requiredOption("-i, --input <path|url>", "Input image path or https URL").option("-o, --output <path>", "Write result JSON to a file").option("-m, --model <name>", "Provider model name").option("-p, --provider <name>", `Vision provider (${listProviders().join(", ")})`).option("--prompt <text>", "Extra focus for this image").option("--timeout <ms>", "Provider timeout in milliseconds", "180000").option("--provider-bin <path>", "Provider binary path (default: agy)").option("--workdir <path>", "Working directory for the provider").option(
   "--extra-body <json>",
   `JSON merged into the API request body, e.g. '{"thinking":{"type":"disabled"}}'`
@@ -4675,7 +4675,7 @@ program.command("doctor").description(
       configPath: CONFIG_PATH,
       // Lets doctor name an installed skill copy that is older than
       // the CLI reporting on it (issue #33).
-      version: "3.18.0"
+      version: "3.18.2"
     });
     const output = options.json ? JSON.stringify(report, null, 2) : renderDoctorReport(report);
     process.stdout.write(`${output}

package/docs/harness-setup.md

@@ -55,7 +55,7 @@ OpenCode with DeepSeek: `opencode auth login`, pick DeepSeek and paste the key (
 dsh is different from the other harnesses: modlens plugs in as a native tool, not a prompt-triggered skill. The package itself is a dsh bundle, so one command installs it into a profile:
 
 ```sh
-npx -y @deepseek-ai/dsh plugin --profile web add @liustack/modlens@3.18.0
+npx -y @deepseek-ai/dsh plugin --profile web add @liustack/modlens@3.18.2
 ```
 
 This registers a `modlens_read_image` tool whose schema reaches the model on every request (no trigger heuristics), runs the modlens CLI shipped inside the same package, and returns the structured evidence as the tool's canonical JSON output. Engines, reuse grants, and guard rules stay in `~/.modlens/config.json`, shared with every other harness. dsh is in developer preview and its plugin surface may change; the plugin keeps its touch small (raw tool registration, the llm adapter surface for the vision variants, the attachment reader, and one agent pre-step hook) and degrades loudly if any of them moves.
@@ -81,7 +81,7 @@ modlens ships often, and both install shapes freeze at whatever version they
 got. On dsh, re-run the install with the version named:
 
 ```sh
-npx -y @deepseek-ai/dsh plugin --profile <name> add @liustack/modlens@3.18.0
+npx -y @deepseek-ai/dsh plugin --profile <name> add @liustack/modlens@3.18.2
 ```
 
 `npm view @liustack/modlens version` prints the current one, and this page is

package/docs/harness-setup.zh-CN.md

@@ -55,7 +55,7 @@ OpenCode 接 DeepSeek：执行 `opencode auth login`，选择 DeepSeek 并粘贴
 dsh 与其他 harness 不同：modlens 以原生工具的形式接入，而不是靠提示词触发的 skill。本包自身就是一个 dsh bundle，一条命令即可装进某个 profile：
 
 ```sh
-npx -y @deepseek-ai/dsh plugin --profile web add @liustack/modlens@3.18.0
+npx -y @deepseek-ai/dsh plugin --profile web add @liustack/modlens@3.18.2
 ```
 
 这会注册一个 `modlens_read_image` 工具，它的 schema 随每次请求抵达模型（不靠触发启发式），运行同一个包里自带的 modlens CLI，并把结构化证据作为工具的标准 JSON 输出返回。引擎、复用授权和 guard 规则仍在 `~/.modlens/config.json` 里，与其他所有 harness 共享。dsh 还在开发者预览阶段，插件接口可能变化。这个插件刻意保持很小的接触面（原生工具注册、视觉变体所用的 llm 适配层、附件读取器，以及一个 agent 执行前钩子），其中任何一处变动，它都会大声报错而不是无声退化。
@@ -71,7 +71,7 @@ dsh 的网页用户面前没有终端，所以引擎设置有一张卡片，在*
 modlens 发布很频繁，而两种安装形态都会冻结在装进来的那个版本上。dsh 上重跑一遍安装即可，版本号要点名：
 
 ```sh
-npx -y @deepseek-ai/dsh plugin --profile <name> add @liustack/modlens@3.18.0
+npx -y @deepseek-ai/dsh plugin --profile <name> add @liustack/modlens@3.18.2
 ```
 
 `npm view @liustack/modlens version` 可以查到当前版本号，本页的版本号则由发布流程自动写入。

package/docs/troubleshooting.md

@@ -163,7 +163,7 @@ simply lands on an older one. Name the exact version instead, which pnpm treats
 as a deliberate request rather than a resolution:
 
 ```sh
-npx -y @deepseek-ai/dsh plugin --profile <name> add @liustack/modlens@3.18.0
+npx -y @deepseek-ai/dsh plugin --profile <name> add @liustack/modlens@3.18.2
 ```
 
 `npm view @liustack/modlens version` prints the current one. pnpm 11 installs a named
@@ -178,7 +178,7 @@ file:
 
 ```yaml
 minimumReleaseAgeExclude:
-  - '@liustack/modlens@3.18.0'
+  - '@liustack/modlens@3.18.2'
 ```
 
 Or lift the gate for a single command, which lifts it for everything that

package/docs/troubleshooting.zh-CN.md

@@ -144,7 +144,7 @@ dsh profile 装到的是旧版 modlens。`dsh.bundle` 声明从 3.9.0 起才存
 `@latest` 绕不开这一层，本页早先的说法是错的。冷静期先把候选版本过滤掉，dist-tag 才在剩下的里面解析，于是它直接落到了更旧的那个上。改成写死精确版本号，pnpm 会把它当作一次明确的指定，而不是一次解析：
 
 ```sh
-npx -y @deepseek-ai/dsh plugin --profile <name> add @liustack/modlens@3.18.0
+npx -y @deepseek-ai/dsh plugin --profile <name> add @liustack/modlens@3.18.2
 ```
 
 `npm view @liustack/modlens version` 可以查到当前版本号。pnpm 11 会装上被点名的版本，11.1.3 起还会把它作为一条已批准的例外写进该 profile 的 `pnpm-workspace.yaml`，其余所有包和 modlens 以后的版本仍然留在窗口后面。
@@ -153,7 +153,7 @@ npx -y @deepseek-ai/dsh plugin --profile <name> add @liustack/modlens@3.18.0
 
 ```yaml
 minimumReleaseAgeExclude:
-  - '@liustack/modlens@3.18.0'
+  - '@liustack/modlens@3.18.2'
 ```
 
 或者只为这一条命令解除冷静期，注意它解除的是这条命令解析到的所有包，不只 modlens：

package/dsh/client.js

@@ -287,6 +287,71 @@ window.__ModuleLoader__.load({
       return payload
     }
 
+    /**
+     * How to render the API key field so the characters are hidden.
+     *
+     * A real password input makes Safari's iCloud Keychain offer to enable
+     * autofill for the site and then pop its bubble on every focus, for a
+     * field that is always empty: the key lives in the config file and the
+     * host never sends it here, only whether one is stored. `autocomplete`
+     * cannot turn that off, because WebKit ignores it on password fields on
+     * purpose (issue #56). Masking with text-security gets the same hidden
+     * characters without ever being a password field, and it also keeps a key
+     * meant for one machine out of a synced keychain.
+     *
+     * Feature-detected rather than assumed. Where the property is missing the
+     * field stays a password input: the nuisance is worth more than the
+     * alternative, which is somebody's API key rendered in clear text while
+     * they type it.
+     *
+     * This is a trade, not a free win, and the cost falls on people who are
+     * not in the room. A password input carries a protected state into the
+     * accessibility tree, and screen readers stop reading characters back
+     * because of it. Masking is only paint: VoiceOver and NVDA will read this
+     * key aloud, and ARIA has no equivalent to restore. Selection and copy
+     * also become possible, and an IME candidate window shows what is being
+     * typed above the field. Accepted here because the field is empty in
+     * normal use (the key lives in the config file and is never sent to the
+     * browser), so what a screen reader can read back is what the user is
+     * typing at that moment, not a stored secret.
+     */
+    /**
+     * Whether this browser masks a text field's characters. Only the prefixed
+     * property exists: there is no unprefixed `text-security`, so probing for
+     * one would be dead code that reads like a real path.
+     *
+     * A throwing `supports` counts as no support. The spec says the two
+     * argument form returns false for an unknown property rather than
+     * throwing, but this runs inside render, where an exception takes the
+     * whole settings surface down instead of costing one field.
+     */
+    function supportsTextSecurity() {
+      try {
+        return (
+          typeof CSS === 'object' &&
+          CSS !== null &&
+          typeof CSS.supports === 'function' &&
+          CSS.supports('-webkit-text-security', 'disc') === true
+        )
+      } catch {
+        return false
+      }
+    }
+
+    function secretFieldProps() {
+      if (!supportsTextSecurity()) {
+        return { type: 'password' }
+      }
+      return {
+        type: 'text',
+        autoComplete: 'off',
+        autoCorrect: 'off',
+        autoCapitalize: 'off',
+        spellCheck: false,
+        style: { WebkitTextSecurity: 'disc' },
+      }
+    }
+
     function ConfigCard(react, ui) {
       var h = react.createElement
       var Input = ui.Input
@@ -411,19 +476,21 @@ window.__ModuleLoader__.load({
               noteState[1]('')
             }
 
+            var inputProps = (key, placeholder) => ({
+              value: draft[key],
+              placeholder: placeholder,
+              onChange: (event) => {
+                set(key, event.target.value)
+              },
+            })
             var textField = (label, key, type, placeholder) =>
-              fieldRow(
-                label,
-                h(Input, {
-                  type: type,
-                  value: draft[key],
-                  placeholder: placeholder,
-                  onChange: (event) => {
-                    set(key, event.target.value)
-                  },
-                }),
-                key,
-              )
+              fieldRow(label, h(Input, Object.assign(inputProps(key, placeholder), { type: type })), key)
+            // Its own function rather than a `type` string the caller has to
+            // spell right. A sentinel compared with `===` fails open: one
+            // typo, or a later edit passing 'text', and the key renders in
+            // clear text with every test still green.
+            var secretField = (label, key, placeholder) =>
+              fieldRow(label, h(Input, Object.assign(inputProps(key, placeholder), secretFieldProps())), key)
 
             // Auto mode: the probes say which harnesses exist on this
             // machine. Found ones get a checkbox with their status; missing
@@ -436,7 +503,7 @@ window.__ModuleLoader__.load({
               var probe = probes.find((candidate) => candidate.harness === name)
               return probe ? probe.cliFound : false
             }).map((name) => {
-              var probe = probes && probes.find((candidate) => candidate.harness === name)
+              var probe = probes?.find((candidate) => candidate.harness === name)
               return h(
                 'label',
                 {
@@ -531,7 +598,7 @@ window.__ModuleLoader__.load({
                       ),
                       'clinote',
                     )
-                  : textField(t.apiKey, 'apiKey', 'password', current.hasKey ? t.stored : t.unset),
+                  : secretField(t.apiKey, 'apiKey', current.hasKey ? t.stored : t.unset),
               draft.provider === '' || keyless ? null : textField(t.baseUrl, 'baseUrl', 'text', t.fallback),
               draft.provider === '' ? null : textField(t.model, 'model', 'text', t.fallback),
               // Where these values are coming from, said once, because the
@@ -779,7 +846,7 @@ window.__ModuleLoader__.load({
             try {
               mountCard(scope)
             } catch (error) {
-              console.error('[modlens] settings card skipped: ' + error)
+              console.error(`[modlens] settings card skipped: ${error}`)
             }
           })
           .catch(() => {})
@@ -791,7 +858,7 @@ window.__ModuleLoader__.load({
       try {
         react = require('react')
       } catch (error) {
-        console.error('[modlens] settings card skipped: ' + error)
+        console.error(`[modlens] settings card skipped: ${error}`)
         return
       }
       var ui = require('@deepseek-ai/dsh-client-ui-primitives')
@@ -819,7 +886,12 @@ window.__ModuleLoader__.load({
 
     exports.apply = apply
     // Exposed for the repo's tests only; not part of the plugin contract.
-    exports.__card = { nextDraft: nextDraft, savePayload: savePayload }
+    exports.__card = {
+      nextDraft: nextDraft,
+      savePayload: savePayload,
+      secretFieldProps: secretFieldProps,
+      ConfigCard: ConfigCard,
+    }
     // `slots` is optional, so it is not required here: registerCard checks.
     exports.inject = []
     return module.exports

package/dsh/index.js

@@ -12,7 +12,7 @@
 // rules keep living in ~/.modlens/config.json, shared with every harness.
 import { spawn } from 'node:child_process'
 import { chmodSync, lstatSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs'
-import { homedir } from 'node:os'
+import { homedir, tmpdir } from 'node:os'
 import { dirname, join } from 'node:path'
 import { fileURLToPath } from 'node:url'
 
@@ -67,7 +67,7 @@ export function apply(ctx, config = {}) {
         try {
           // scope carries webServer; the plugin's own ctx carries llm for the
           // takeover verdicts.
-          registerPasteRoute(scope, ctx, ownProviders)
+          registerPasteRoute(scope, ctx, ownProviders, config)
         } catch (error) {
           console.error(`[modlens] paste-to-path route skipped: ${error}`)
         }
@@ -326,7 +326,7 @@ const PASTE_VERDICT_CAP = 32
  * stands down instead of swallowing pastes into a 404. Bound to the dsh web
  * server, which listens on loopback by default.
  */
-function registerPasteRoute(ctx, host, ownProviders) {
+function registerPasteRoute(ctx, host, ownProviders, config = {}) {
   const verdicts = new Map()
   // The cache key is only the selector label, which cannot tell two
   // same-named models on different routes apart. A route mounting mid-TTL
@@ -413,11 +413,23 @@ function registerPasteRoute(ctx, host, ownProviders) {
           return
         }
         const { mkdtemp, writeFile } = await import('node:fs/promises')
-        const { tmpdir } = await import('node:os')
         const { join } = await import('node:path')
-        const dir = await mkdtemp(join(tmpdir(), 'modlens-dsh-paste-'))
+        const root = await openPasteRoot(config.pasteDir)
+        const dir = await mkdtemp(join(root, 'p-'))
         const file = join(dir, `paste${sniff.ext}`)
         await writeFile(file, buffer, { mode: 0o600 })
+        // This one cannot be deleted when the request ends: its path is what
+        // goes into the composer, so the file has to outlive the response and
+        // survive until the model reads it. Nothing was ever collecting them
+        // afterwards though, so they accumulated for as long as dsh was
+        // installed (issue #51). Sweeping the expired ones here keeps it to
+        // the moment a paste already costs a disk write, with no timer to
+        // own and nothing running when nobody is pasting.
+        // Fire and forget: the response must not wait on housekeeping. The
+        // promise is kept so a test can await the side effect instead of
+        // racing it, which is otherwise a coin flip decided by the scheduler.
+        lastPasteSweep = sweepExpiredPastes(Date.now(), root)
+        void lastPasteSweep
         res.writeHead(200, { 'content-type': 'application/json' })
         res.end(JSON.stringify({ path: file }))
       } catch (error) {
@@ -1255,6 +1267,198 @@ function isTrustedRequest(req) {
   }
 }
 
+/**
+ * How long a pasted file stays reachable.
+ *
+ * This is a proxy for "nobody needs it any more", and a proxy is all that is
+ * available: the path leaves through the composer as plain text, so nothing
+ * here observes whether the draft holding it was sent, cleared, or abandoned.
+ * A week errs the way that asymmetry asks for. Deleting too early breaks a
+ * draft somebody is still writing and reads as a bug in the paste; deleting
+ * too late costs a few kilobytes in a directory the OS already collects.
+ */
+const PASTE_TTL_MS = 7 * 24 * 60 * 60 * 1000
+
+/**
+ * A ceiling on what unread pastes may hold, independent of age. One image may
+ * be 25 MB, so a week is long enough for a burst to reach tens of gigabytes
+ * before any of it expires. This only engages far past ordinary use, and it
+ * removes oldest first, which is a worse rule than liveness but the only one
+ * available; running a disk out of space is worse than either.
+ */
+const PASTE_STORE_MAX_BYTES = 1024 * 1024 * 1024
+
+/** The most recent sweep, so tests can await what production does not. */
+let lastPasteSweep = Promise.resolve()
+
+/** Everything this plugin writes for pastes lives under one directory. */
+function pasteRoot(base = null) {
+  return base ?? join(tmpdir(), 'modlens-dsh-paste')
+}
+
+/**
+ * Open the store directory, or refuse it.
+ *
+ * The path is predictable and the system temp directory is shared, so on a
+ * multi-user machine somebody else can get there first. A symlink planted at
+ * that name would point this plugin's recursive cleanup at whatever it names,
+ * which is the oldest trick there is against a program that tidies up in
+ * /tmp. So an existing entry has to be a real directory this user owns, and a
+ * new one is created private. Anything else is refused, and the paste fails
+ * loudly rather than writing into somebody else's directory.
+ */
+async function openPasteRoot(base = null) {
+  const { mkdir, lstat, chmod, realpath } = await import('node:fs/promises')
+  const { basename, dirname } = await import('node:path')
+  const root = pasteRoot(base)
+  // Create first, then check. Checking first leaves a window between the
+  // answer and the use, and on a shared temp directory that window is enough
+  // for somebody to drop a symlink at the name and have this write into
+  // whatever it points at. An exclusive mkdir either creates the directory,
+  // in which case it is ours by construction, or reports that something is
+  // already there, which is the case worth inspecting.
+  // Canonicalise the parent first, then work inside it. A system temp
+  // directory is often behind a legitimate link (macOS puts /var behind
+  // /private/var), so refusing every resolved ancestor would refuse ordinary
+  // machines. What must not be a link is the leaf: an exclusive mkdir
+  // succeeds just as happily through one, and the directory it makes then
+  // sits wherever that link points.
+  const parent = dirname(root)
+  await mkdir(parent, { recursive: true }).catch(() => {})
+  let realParent
+  try {
+    realParent = await realpath(parent)
+  } catch (error) {
+    throw new Error(`${parent} is not usable for the paste store: ${error?.message ?? error}`)
+  }
+  const target = join(realParent, basename(root))
+  try {
+    await mkdir(target, { mode: 0o700 })
+  } catch (error) {
+    if (error?.code !== 'EEXIST') {
+      throw error
+    }
+  }
+  // lstat, so a link reads as a link rather than as whatever it points at.
+  const info = await lstat(target)
+  if (!info.isDirectory()) {
+    throw new Error(`${target} exists and is not a directory`)
+  }
+  // POSIX ownership and mode bits are one capability boundary. Windows has
+  // neither getuid nor owner/group/other mode distinctions, and reports a
+  // directory as 0777 even when its ACL is private. Applying this verdict
+  // there would reject every paste without proving anything about its ACL.
+  const uid = typeof process.getuid === 'function' ? process.getuid() : undefined
+  if (uid !== undefined) {
+    if (info.uid !== uid) {
+      throw new Error(`${target} belongs to another user`)
+    }
+    // Narrow it even if it was created wider, so a later paste is not readable
+    // by everyone on the machine. A failure here is not cosmetic: it means the
+    // directory stays readable by others and this cannot fix it, so the paste
+    // is refused rather than written where it can be read.
+    if ((info.mode & 0o777) !== 0o700) {
+      await chmod(target, 0o700)
+      const after = await lstat(target)
+      if ((after.mode & 0o777) !== 0o700) {
+        throw new Error(`${target} could not be made private`)
+      }
+    }
+  }
+  return target
+}
+
+/**
+ * Remove pastes that have expired, then, if what remains is still too large,
+ * the oldest until it is not.
+ *
+ * The sweep only ever looks inside our own directory. An earlier version
+ * scanned the whole system temp directory, which made every paste pay for
+ * every unrelated entry there and put the blast radius of a bug in somebody
+ * else's files. Entries are read with withFileTypes so a symlink reads as a
+ * link and never as the directory it points at, because a cleanup that
+ * follows a link is how it becomes somebody else's deleted files.
+ *
+ * The root is a parameter so tests never run this against the real one, where
+ * they would delete a developer's own live pastes. That matters more than it
+ * sounds: the route calls this on every successful paste, so any test that
+ * exercises the route runs it too.
+ */
+async function sweepExpiredPastes(now = Date.now(), base = null, maxBytes = PASTE_STORE_MAX_BYTES) {
+  try {
+    const { readdir, stat, rm } = await import('node:fs/promises')
+    const root = pasteRoot(base)
+    const kept = []
+    for (const entry of await readdir(root, { withFileTypes: true })) {
+      if (!entry.isDirectory()) continue
+      const full = join(root, entry.name)
+      try {
+        const info = await stat(full)
+        if (now - info.mtimeMs >= PASTE_TTL_MS) {
+          try {
+            await rm(full, { recursive: true, force: true })
+            continue
+          } catch {
+            // Held open, or removed only in part. Either way it still
+            // occupies the disk, so it stays on the books rather than being
+            // silently written off and leaving the ceiling reading low.
+          }
+        }
+        // A directory that cannot be measured still occupies the disk, so it
+        // stays on the books at the largest a single paste may be. Erring
+        // high makes the ceiling clean sooner; erring low, or dropping the
+        // entry, lets the store grow while the ceiling reads comfortable.
+        const bytes = await directorySize(full).catch(() => PASTE_MAX_BYTES)
+        kept.push({ full, mtimeMs: info.mtimeMs, bytes })
+      } catch {
+        // Vanished between listing and measuring. A paste must never fail
+        // over housekeeping.
+      }
+    }
+    let total = kept.reduce((sum, item) => sum + item.bytes, 0)
+    if (total <= maxBytes) return
+    for (const item of kept.sort((a, b) => a.mtimeMs - b.mtimeMs)) {
+      if (total <= maxBytes) break
+      try {
+        await rm(item.full, { recursive: true, force: true })
+        total -= item.bytes
+      } catch {
+        // Still held, or gone only in part. Measure what is actually left
+        // instead of trusting the subtraction, and keep going: one
+        // undeletable directory must not stop the rest from being freed.
+        total -= item.bytes - (await directorySize(item.full).catch(() => item.bytes))
+      }
+    }
+  } catch {
+    // No directory yet, or no listing available. The paste itself worked.
+  }
+}
+
+/**
+ * What a paste directory occupies, or a throw when that cannot be known.
+ *
+ * A file that vanished between listing and measuring really does occupy
+ * nothing, so it counts as zero. Any other failure means the number would be
+ * an undercount, and an undercount here is worse than no answer: the caller
+ * puts an unmeasurable directory on the books at the largest a paste may be,
+ * while a quietly low number lets the store pass a ceiling it has already
+ * exceeded.
+ */
+async function directorySize(dir) {
+  const { readdir, stat } = await import('node:fs/promises')
+  let bytes = 0
+  for (const entry of await readdir(dir, { withFileTypes: true })) {
+    if (!entry.isFile()) continue
+    try {
+      bytes += (await stat(join(dir, entry.name))).size
+    } catch (error) {
+      if (error?.code === 'ENOENT') continue
+      throw error
+    }
+  }
+  return bytes
+}
+
 function registerConfigRoute(ctx) {
   ctx.webServer.register({
     name: 'modlens-config',
@@ -1321,3 +1525,13 @@ function registerConfigRoute(ctx) {
 // and write a real file and a real environment, so they are tested against
 // both rather than through the HTTP route.
 export const __config = { engineSummary, applyEngineSettings, modlensConfigPath }
+
+// The paste sweeper, reachable from the test suite the way __config is.
+export const __paste = {
+  sweepExpiredPastes,
+  settled: () => lastPasteSweep,
+  openPasteRoot,
+  pasteRoot,
+  ttlMs: PASTE_TTL_MS,
+  maxBytes: PASTE_STORE_MAX_BYTES,
+}

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@liustack/modlens",
-    "version": "3.18.0",
+    "version": "3.18.2",
     "description": "Plug-in vision for text-only LLMs, powered by the free Antigravity CLI",
     "type": "module",
     "bin": {

package/skills/modlens/SKILL.md

@@ -20,11 +20,11 @@ powershell -ExecutionPolicy Bypass -File <skill-dir>\scripts\run.ps1 <args>
 
 It resolves a working runtime (PATH `modlens`, then `npx`, then `bunx`) and forwards your arguments unchanged. Exit 78 means no runtime: relay the `nextSteps` from its stderr JSON instead of retrying.
 
-If your harness forbids running scripts, reason through the same order by hand and run the first line that works (the pinned version is 3.18.0):
+If your harness forbids running scripts, reason through the same order by hand and run the first line that works (the pinned version is 3.18.2):
 
-1. A `modlens` on `PATH` whose major version is 3 and is at least 3.18.0: `modlens <args>`.
-2. Otherwise, if `npx` exists: `npx --yes --package @liustack/modlens@3.18.0 modlens <args>`.
-3. Otherwise, if `bunx` exists: `bunx --bun @liustack/modlens@3.18.0 <args>`.
+1. A `modlens` on `PATH` whose major version is 3 and is at least 3.18.2: `modlens <args>`.
+2. Otherwise, if `npx` exists: `npx --yes --package @liustack/modlens@3.18.2 modlens <args>`.
+3. Otherwise, if `bunx` exists: `bunx --bun @liustack/modlens@3.18.2 <args>`.
 4. Otherwise tell the user no JavaScript runtime was found and that installing Node 22.19+ (https://nodejs.org) or Bun (https://bun.sh) is the next step. Do not claim modlens itself failed.
 
 `references/runtime.md` documents the pin and the diagnostic fields.

package/skills/modlens/references/runtime.md

@@ -8,7 +8,7 @@ shell syntax.
 
 ## Pinned version
 
-- Pinned CLI version: 3.18.0
+- Pinned CLI version: 3.18.2
 - npm package: `@liustack/modlens`
 - CLI binary name: `modlens`
 

package/skills/modlens/scripts/run.ps1

@@ -24,7 +24,7 @@ $ErrorActionPreference = 'Stop'
 # package.json version, and the release script rewrites it on every bump.
 $Package = '@liustack/modlens'
 $Bin = 'modlens'
-$Pinned = '3.18.0'
+$Pinned = '3.18.2'
 # -------------------------------------------------------------------------------
 
 $NativeNote = 'no native artifact is published for this tool yet; phase A ships npm launch paths only'

package/skills/modlens/scripts/run.sh

@@ -22,7 +22,7 @@ set -eu
 # package.json version, and the release script rewrites it on every bump.
 PKG="@liustack/modlens"
 BIN="modlens"
-PINNED="3.18.0"
+PINNED="3.18.2"
 # -------------------------------------------------------------------------------
 
 NATIVE_NOTE="no native artifact is published for this tool yet; phase A ships npm launch paths only"